Mobile Security - Tutorial 1. Beginning Advanced Android Development Brian Ricks Fall 2014

Transcription

1 Mobile Security - Tutorial 1 Beginning Advanced Android Development Brian Ricks Fall 2014

2 Before we begin... I took your Wireless Network Security course in Spring... are you gonna have memes in this? No

3 What are we doing? Eat up tidbits of knowledge beyond just the basics We assume you have some Android fundamentals already, and are fluent in Java Devour background needed for the homeworks.. and the course projects also

4 What do you need? Something to write code in Android Studio is recommended The ADT plugin for Eclipse is an alternative The Android SDK

5 Lets Get Started Topics Processes Services Threads Intents

6 Processes Talking about Linux processes here Everything that makes up an app (components) are run from the same process and thread (main thread) Can spawn other threads Can change which process a component runs in by messing with the manifest (android:process)

7 Process Lifecycle Shamelessly ripped from: and_activity_lifecycles

8 Process Lifecycle What does a visible process mean? One that is technically visible to the user, but is not in the foreground An activity from another process that does not take up the entire screen Think the messenger window from FB messenger, or a dialog An activity (from another process) which takes up the entire screen would make the activity under it not visible

9 Process Lifecycle What is the difference between a service and background process? A background process contains activities not visible to the user, but is not hosting any services that would qualify it for service process priority Some subtle differences Service processes may not contain activities Background processes always contain activities not visible to the user Otherwise, it would be an empty process

10 Activities Component that provides user interaction to accomplish some task Any screen you see when running an app is an activity, and each activity has a screen associated with it These interact with each other (and possibly other components) to form apps

11 Activity Lifecycle In terms of state Shamelessly ripped from:

12 Activity Lifecycle In terms of visibility Shamelessly ripped from: ndling_android_activity_state_changes

13 Activity Lifecycle A note about onpause() vs onstop() in terms of visibility onpause() - Activity still has visible scope. As with visible processes, this means some other activity will capture the foreground (user interaction), but is not taking up the entire screen onstop() - This activity is about to be covered entirely (the screen) by another activity

14 Activities - Starting When you start an activity: The activity which called it is stopped The starting activity is pushed onto a stack (called the back-stack) It's onpause() method is called It's oncreate() method is called (followed by onstart() and onresume()) Now it has foreground visibility If the calling activity is no longer visible It's onstop() method is called

15 Activities Back Stack Shamelessly ripped from: and_activity_lifecycles

16 Activities Saving State When an activity loses foreground visibility, it's state is saved (until killed) What if the activity is killed and you want to save state? onsaveinstancestate() - write state info as key/value pairs to a Bundle (container of key/value pairs) No guarantees for its calling persistent data should be saved during onpause() - UI state saved during onsaveinstance() onrestoreinstancestate() and oncreate(), this Bundle is passed Null Bundle implies activity created for the first time

17 Activities Saving State Why is this important? Activities are destroyed during events you may not consider When the user turns the phone, and the screen reorients, this causes the activity to be destroyed and recreated

18 Activities Saving State What if I'm too lazy to save state? Some UI state is saved anyways, so maybe being lazy is fine?

19 Services A component that doesn't have user interaction, usually longer-running tasks. Can be used to do background processing of some task by an app Note: services do not run in their own threads by default Can be shared with other apps

20 Service Lifecycle Shamelessly ripped from: roid_services.htm

21 Services - Starting startservice() Creates the service, calls oncreate(), then onstartcommand() bindservice() Used to create a connection to a service Command (intent) is passed from whatever requested the service Will create service if not already running Does not call onstartcommand() Services (not-bounded) will run even if the starting app is terminated

22 Services - Stopping stopservice() Services can also use stopself() Bound services: If any components have a connection (bound) to the service, it will keep running until all connections are terminated A service is considered a bound service if it was created using bindservice(), and onstartcommand() was not called

23 Services vs Threads Which should I use for background tasks? Depends on what you wanna do Do you need something to be running even if your app is not? Do you only need something to be running if your app is currently running? Services perhaps Threads perhaps Services should be in their own threads You can use the IntentService class to accomplish this

24 Services and Threads Why should I put my services in their own threads? If they are in your main thread, then they can block UI related tasks (and cause ANR issues) ANR? Application Not Responding Android will pop up a really nasty dialog alerting the user to how much your app sucks if a foreground activity does not react to user input within 5 seconds

25 Services and Threads Can I be lazy and not care about ANR issues? I won't be running your code, so why not?

26 Threads Well, we should probably talk about threads now...

27 Threads Android apps by default follow a single thread model But you can spin off your own threads But... the UI toolkit is not thread safe What does this all mean? All UI needs to be done from the main thread Any other tasks can be spun off to their own threads But don't call any UI methods from these threads

28 Threads - Creating How do I create threads? Same way as you would in Java

29 Threads UI Manipulation How do I manipulate UI from outside the main thread? An easy way is to use AsyncTask instead of Thread Separates what should be run in a separate thread vs what should be run in the main thread Another easy way is to use the Handler class With this method, you can still use the Thread class, but handle synchronization with the UI by using the Handler class. Provides a callback method to handle messages sent from other threads

30 Threads - Termination Under what conditions will a spawned thread terminate? Containing process terminates Threads created using AsyncTask will terminate if the activity does Threads created manually may still be running and, if your activity is recreated (say by turning the screen orientation), the thread may keep running Don't assume Java will reclaim the thread

31 Threads When to Use To save time and mess, follow these guidelines Do you need to run a background task for a short duration, and it's related to an activity? Do you need to run a background task for a long duration, and it's related to an activity? AsyncTask created threads AsyncTask created threads, or set it up manually and make sure to terminate the thread in the activity's ondestroy() method Do you need to run a background task not related to a specific activity? Use a service

32 Intents Now on to Intents The intent of these slides is to fill you in on why intents are awesome

33 Intents Messengers between components Usually between activities, but can be any context class Three main use cases Starting activities Starting services Deliver broadcasts

34 Intents Starting Activities startactivity() method If you want a result sent back to your activity, use startactivityforresult() instead Will receive another intent, passed to your onactivityresult() callback method, when the calling activity finishes

35 Intents Explicit vs Implicit Explicit Here, you know exactly which component you want to send the intent too. You specify the component name by its class. Usually used when starting activities within a common app Implicit Here, you may not know (or care) which component can handle a request, so you specify in the intent what you need done You want the ability to import camera shots to your app, so you use an implicit intent to request a component which can take the shots

36 Intents - Implicit The android system acts as a matchmaker Shamelessly ripped from:

37 Intents - Implicit How does android know which components will match my request? Compare contents of intent to intent-filters specified in other apps' manifests If only one match is found, that component is started If multiple matches are found, system prompts user to pick

38 Intents - Implicit What criteria does the matching use? Intent action: Action specified in the intent must match one of the actions specified in the manifest Intent category: Each category specified in the intent must match a category specified in the manifest Intent data (URI/MIME): Matching based on which URI/MIME types are present in the intent compared to what is present in the manifest

39 Intents - Implicit What about if I use an implicit intent to start a service? If multiple services can handle the intent, one of them will start, and the user will not know which one Best to use explicit intents in the case of services

40 Intents - Implicit So if I declare in my app's manifest that component X can handle intent-filter Y, I will receive these requests? Maybe. If your app is the only app installed that can handle intent-filter Y, then it will Or, your app will be one of many in a list for the user to choose from Apps can force the chooser dialog to display

41 Intents - Implicit How can I determine if the device has any installed components that can handle a specific intent request? PackageManager class Can query the system about installed apps and services which can handle a given intent

42 The End Disclaimer: Meme is in no way presented here to disrespect Dennis Ritchie or his legacy, only your mother.